Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30-05-2024 04:40
General
-
Target
2024-05-30_7fcb663172c328c722b61ac571f3dbb1_cryptolocker.exe
-
Size
40KB
-
MD5
7fcb663172c328c722b61ac571f3dbb1
-
SHA1
6c5c577b9cbaef9c739648fef7573c6a86a3117a
-
SHA256
116af68db7938e3b9f00548318d64fd2a4e54c320474e0d1167f101e544e0f52
-
SHA512
48be85f5774a22f0aab54a71d171cadb4751c47c8499b4d4b5b84fe921cf406963b995ad23e68ebb900d59ef37d202e0c337e06871dbf9838ce151b4937be3db
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYXn:qDdFJy3QMOtEvwDpjjWMl7Te
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_7fcb663172c328c722b61ac571f3dbb1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_7fcb663172c328c722b61ac571f3dbb1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD597c9a8a86980b23b0c3cba203cf7f386
SHA189009c9a8f744ebe21687b0a324cadb578e01dd1
SHA256fd33b59df4f085c7d8b2bcd61e7910a615e5b09272d26becf44882bea37d8aaa
SHA512b403c557e03e1345a7c6ec22ddc1b310b2ed6dafd53ecd45ee7285957c94568275c0e02ec00a27d4173df9dce1a52a19fa81d7b4acb107da2bf3a3e87592475c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB